Cyber Risk & Compliance Leader

6090-Johnson & Johnson Services Inc. Legal Entity; New Brunswick (NJ); On-site; USD 140,000 - 200,000; Full time

Job summary

Johnson & Johnson seeks a Professional, Compliance Lead in Cybersecurity GRC to own policy and standards, drive risk assessments, and deliver executive risk reporting from New Jersey and other U.S. locations.

You will lead third-party risk programs, coordinate with Internal Audit and regulators, and shape risk-aware culture across the enterprise. Requires 6+ years in GRC and certifications such as CISSP/CRISC/CISM/CISA.

Qualifications

• 6 years of progressive experience in cybersecurity governance, IT risk management, or a related GRC discipline.
• Advanced knowledge of policy and standards governance, lifecycle, and stakeholder approvals.
• Proven mastery of NIST CSF, NIST 800-53, ISO 27001/27002, and COBIT.
• Experience designing and operating a cyber risk assessment methodology and enterprise risk register.
• Experience leading third-party/vendor cyber risk programs including SOC 2/ISO evidence review.
• Strong facilitation and influencing skills with senior stakeholders.

Responsibilities

• Lead the cybersecurity policy and standards program end to end—governance lifecycle, content approvals, and attestations.
• Define and maintain the enterprise cyber risk framework and methodology, including risk taxonomy and thresholds.
• Direct cyber risk assessments across applications, infrastructure, and business processes; ensure quality and traceability.
• Own governance of the enterprise cyber risk register and escalate elevated risks to leadership.
• Chair cybersecurity governance forums, document outcomes, and drive accountable actions.
• Deliver executive reporting translating risk, control, and compliance data for leadership.
• Define KRIs and predictive signals to drive proactive intervention.
• Lead third-party cyber risk oversight with vendor assessment standards and security requirements.
• Maintain regulatory and framework mappings (NIST, ISO, HIPAA, GDPR, FDA guidance, SOX ITGC).
• Collaborate with IT Controls and SOX to ensure coherent assurance across domains.
• Coordinate with Internal Audit, regulators, and customer security assessments.

Skills

GRC frameworks

NIST CSF

ISO 27001/27002

COBIT

Risk assessment

Executive reporting

Vendor risk

Regulatory liaison

Policy development

Education

CISSP

CRISC

CISM

CISA

Tools

ServiceNow IRM

Archer

OneTrust

AuditBoard

Power BI

Tableau

SQL

Job description

Johnson & Johnson seeks a Professional, Compliance Lead in Cybersecurity GRC to own policy and standards, drive risk assessments, and deliver executive risk reporting from New Jersey and other U.S. locations.

You will lead third-party risk programs, coordinate with Internal Audit and regulators, and shape risk-aware culture across the enterprise. Requires 6+ years in GRC and certifications such as CISSP/CRISC/CISM/CISA.